Is there a requirement to force https by default?